@sema-agent/server 7.131.0 → 7.133.0

package/dist/config.js

@@ -3,48 +3,55 @@ import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF, mintCapabilityKeys } from "./mod
 import { homedir } from "node:os";
 import { join, posix as posixPath } from "node:path";
 import { fileURLToPath } from "node:url";
-import { compileAllowList, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable } from "@sema-agent/core";
-import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, WEB_ADMIN_ENV, retiredEnvRefusal } from "@sema-agent/settings-schema";
+import { compileAllowList, inheritEnvPolicyProblem, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, principalInboxConsumerOf } from "@sema-agent/core";
+import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, WEB_ADMIN_ENV, retiredEnvRefusal, stripControlAndBidi } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
-import { isV2ScopeKey, memoryReplicationCoverage, replicationCovers } from "./memory-scope.js";
+import { isV2ScopeKey, memoryReplicationCoverage, replicatesProjectLayersOf } from "./memory-scope.js";
+import { assertProjectLayerOwnable } from "./project-identity.js";
+import { projectLayerOwnerOf } from "./project-layer-key.js";
 import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
 import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
-import { CONFIG_PROVIDER_WORDS, RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS, MAX_TIMER_DELAY_MS, AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, DRAIN_GRACE_FLOOR_MS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS, FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS, fleetScopeOf } from "./config-types.js";
+import { CONFIG_PROVIDER_WORDS, RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS, MAX_TIMER_DELAY_MS, AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, DRAIN_GRACE_FLOOR_MS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS, FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS, fleetScopeOf, DEVICE_DELIVERY_TIMEOUT_BOUNDS, DEVICE_EXEC_TIMEOUT_BOUNDS, inWholeNumberBounds, wholeNumberBoundsRule } from "./config-types.js";
+import { DEVICE_HELLO_ACK_BOUNDS } from "./device-ws-protocol.js";
 import { FLEET_GENERATION_ENV, FLEET_SCOPE_ENV, SERVING_LEASE_TTL_FLOOR_MS, isCanonicalGeneration } from "@sema-agent/settings-schema/fleet";
 import { ScopeId } from "@sema-agent/settings-schema/api/scopes";
 import { centerLaneConfigured, pathBaseUrlRefusal } from "./web-admin-client/center-request.js";
 import { resolveLocalDataRoot } from "./local-data-root.js";
 import { buildWriteProtectionPosture } from "./write-protection.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
-import { buildReadFacePostureNotice, readFaceForPosture } from "./read-face-posture.js";
+import { buildReadFacePostureNotice, settleDerivedReadFace } from "./read-face-posture.js";
 import { THINKING_LEVELS, THINKING_FORMATS, buildModelCompat, isThinkingFormat, isThinkingTier } from "./model-compat.js";
 import {} from "./posture-source.js";
 import { COST_QUOTA_WINDOW_SEC_RANGE, costQuotaWindowSecInRange } from "./observability/cost-quota.js";
-import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { TOOL_NAME_ROSTER, describeUnmatchableRuleName, ruleEntryToolName, unmatchableRuleNameOf } from "./namespaced-rule-name.js";
-import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, centerIdentityRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal } from "./config-invariants.js";
+import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, centerIdentityRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal, operatorSingleUserRefusal, workflowParkDecisionDomainRefusal } from "./config-invariants.js";
 import { declaredSemaConfigDir } from "./sema-config-dir.js";
 import { lkgPathOverrideOf } from "./config-lkg.js";
 import { K8S_WORKSPACE_MOUNT_DEFAULT, WORKSPACE_PERSIST_DEFAULT, WORKSPACE_PERSIST_WORDS, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_RANGE, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE, parseWorkspaceSnapshotExclude } from "./workspace-space.js";
 import { laneLivenessOf } from "./exec-bounds.js";
 import { SANDBOX_IPV6_DEFAULT, SANDBOX_IPV6_WORDS } from "./sandbox-egress-policy.js";
-import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS, isK8sQuantity, mountsOverlap } from "./workspace-cache.js";
+import { WORKSPACE_CACHE_DEFAULT, WORKSPACE_CACHE_MOUNT_DEFAULT, WORKSPACE_CACHE_MOUNT_RESERVED, WORKSPACE_CACHE_SIZE_DEFAULT, WORKSPACE_CACHE_WORDS, isK8sQuantity, mountsOverlap, reservedMountCollision } from "./workspace-cache.js";
 import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, executionLaneRequiredRefusal, isSingleMachineDefaultLane, laneRequiredEnv } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
 import { MAX_NAMED_INERT_ENTRIES, allowLayerEntryCountIssue, describeInertRuleEntries, inertRuleEntriesOf, inertRuleEntryGuidance, ruleEntryListShapeOk } from "./rule-entry-list.js";
+import { readReadDenyEntry } from "./read-deny-entry.js";
 import { createCenterCredentialSource, readCenterCredentialDeclaration } from "./center-credential.js";
 import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { httpUrlFlaws } from "@sema-agent/settings-schema";
 import { buildHttpUrlRefusal } from "./url-refusal.js";
+import { customPkgSourceFromEnv } from "./sandbox-pkg-source.js";
 import { csvOf, envLaneTable, mintedCheapId, readModelRouteEnv } from "./model-route-gap.js";
 import { displayListEntry } from "./list-entry-display.js";
+import { echoCallerText } from "./caller-text-echo.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
+import { parseConfigLocalOwnerUid } from "./config-dir-trust.js";
 import { allowlistedEnv } from "./server-secret-env.js";
 import { ENV_NAME_ALLOWLIST_KNOBS, ENV_NAME_ALLOWLIST_KNOB_NAMES, describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
+import { APPROVAL_ASK_RETENTION_DEFAULT_MS, APPROVAL_ASK_RETENTION_FLOOR_MS } from "./approval-ask-retention.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
 function csv(name) {
     return csvOf(process.env[name]);
@@ -183,13 +190,14 @@ function buildExecLaneNotice(remoteExec) {
         source: lane === "in-process" ? "default-unset" : isSingleMachineDefaultLane(remoteExec) ? "default-local-provider" : "explicit-env",
     };
 }
+const ENV_VALUE_ECHO_CHARS = 120;
 function parseConfigProvider() {
     const raw = process.env.CONFIG_PROVIDER;
     if (raw === undefined || raw === "")
         return undefined;
     const word = CONFIG_PROVIDER_WORDS.find((w) => w === raw);
     if (word === undefined) {
-        throw new Error(`env CONFIG_PROVIDER="${raw.slice(0, 120)}" must be one of: ${CONFIG_PROVIDER_WORDS.join(", ")} — or leave it unset (then ${WEB_ADMIN_ENV.url}, if set, selects the center as the config source; otherwise this worker is env-only). ` +
+        throw new Error(`env CONFIG_PROVIDER="${echoCallerText(raw, { maxChars: ENV_VALUE_ECHO_CHARS })}" must be one of: ${CONFIG_PROVIDER_WORDS.join(", ")} — or leave it unset (then ${WEB_ADMIN_ENV.url}, if set, selects the center as the config source; otherwise this worker is env-only). ` +
             `The word is matched exactly (no trimming, no case folding). Refusing to boot rather than guessing: the config source, the execution-lane default and the local config root all key on this one word.`);
     }
     return word;
@@ -338,6 +346,17 @@ function livenessMsEnv(name) {
     const n = optNumEnvStrict(name);
     return n === undefined ? undefined : laneLivenessOf(n, name).ms;
 }
+function parseDeviceBoundedIntEnv(name, raw, bounds) {
+    if (raw === undefined || raw === "")
+        return undefined;
+    const n = /^(0|[1-9]\d*)$/.test(raw) ? Number(raw) : Number.NaN;
+    if (!inWholeNumberBounds(bounds, n)) {
+        const shown = raw.length > 40 ? `${raw.slice(0, 40)}…(${raw.length} chars)` : raw;
+        throw new Error(`env ${name}=${JSON.stringify(shown)} must be ${wholeNumberBoundsRule(bounds)} (canonical decimal digits only — no sign, leading zero, fraction, exponent, hex, whitespace or unit; unset = the device lane's own default). ` +
+            `Refusing to boot rather than sending an out-of-range value to every executor, or running the default while the operator believes their value is in force.`);
+    }
+    return n;
+}
 function parseDeviceEnrollTokenTtlEnv() {
     const raw = process.env.DEVICE_ENROLL_TOKEN_TTL_SEC;
     if (raw === undefined || raw === "")
@@ -440,15 +459,10 @@ function parseReadDenyPatternsEnv(raw) {
     if (!Array.isArray(arr))
         throw new Error('READ_DENY_PATTERNS must be a JSON array of "pattern" strings or {pattern, caseSensitive?} objects');
     const entries = arr.map((it, i) => {
-        if (typeof it === "string")
-            return { pattern: it, caseSensitive: false };
-        if (typeof it !== "object" || it === null || typeof it.pattern !== "string") {
-            throw new Error(`READ_DENY_PATTERNS[${i}] must be a string or an object with a string 'pattern'`);
-        }
-        const cs = it.caseSensitive;
-        if (cs !== undefined && typeof cs !== "boolean")
-            throw new Error(`READ_DENY_PATTERNS[${i}].caseSensitive must be boolean when present`);
-        return { pattern: it.pattern, caseSensitive: cs === true };
+        const read = readReadDenyEntry(it);
+        if (!read.ok)
+            throw new Error(`READ_DENY_PATTERNS[${i}]${read.after}`);
+        return read.entry;
     });
     compileReadDeny(entries);
     return entries;
@@ -467,6 +481,12 @@ function parseNameListEnv(name, raw, opts) {
 }
 const ENV_VAR_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 const ENV_NAME_ALLOWLIST_WITHHELD = "<withheld: entries are not echoed — a value pasted in place of a name can pass the name check>";
+function ownCredentialPutBackProblem(name) {
+    const engine = inheritEnvPolicyProblem([name]);
+    return engine === undefined
+        ? undefined
+        : `this deployment's own credential — a put-back list hands the named variable back, as written, to the child the engine withheld it from (the engine refuses it on any allow list: ${engine})`;
+}
 export function parseEnvNameAllowlist(knob, singleUserTurnkey) {
     const raw = process.env[knob];
     if (raw === undefined || raw === "")
@@ -480,7 +500,9 @@ export function parseEnvNameAllowlist(knob, singleUserTurnkey) {
                 ? 'not an environment-variable name (letters, digits and "_", not starting with a digit)'
                 : ENV_NAME_ALLOWLIST_KNOB_NAMES.has(seg.toUpperCase())
                     ? `the name of a name-list knob (${[...ENV_NAME_ALLOWLIST_KNOB_NAMES].join(" / ")}: their raw text is withheld from every child process and sandbox; naming one would put that text back)`
-                    : undefined;
+                    : spec.channel === "host-put-back"
+                        ? ownCredentialPutBackProblem(seg)
+                        : undefined;
         if (problem === undefined)
             return;
         throw new Error(`env ${knob}: entry #${i + 1} of ${segments.length} is ${problem}` +
@@ -637,11 +659,22 @@ function optionalEnumKey(key, envName, raw, allowed) {
     if (raw === undefined || raw === "")
         return {};
     if (!allowed.includes(raw)) {
-        throw new Error(`env ${envName}="${raw.slice(0, 120)}" must be one of: ${allowed.join(", ")} — or leave it UNSET to say nothing on this layer. ` +
+        throw new Error(`env ${envName}="${echoCallerText(raw, { maxChars: ENV_VALUE_ECHO_CHARS })}" must be one of: ${allowed.join(", ")} — or leave it UNSET to say nothing on this layer. ` +
             `Refusing to boot rather than reading a misspelled value as "unset": that runs the deployment with NO policy on this axis while the operator believes one is configured`);
     }
     return { [key]: raw };
 }
+function principalInboxAssistantKey(raw) {
+    if (raw === undefined || raw === "")
+        return {};
+    try {
+        principalInboxConsumerOf({ principalInboxConsumer: { assistant: raw } });
+    }
+    catch (err) {
+        throw new Error(`env PRINCIPAL_INBOX_ASSISTANT must name the agent handle that consumes the principal inbox (or stay UNSET for no cross-principal delivery): ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return { principalInboxAssistant: raw };
+}
 function parseAutoModeClassifierTimeoutMs(raw) {
     if (raw === undefined || raw === "")
         return {};
@@ -684,7 +717,7 @@ function parseHooksTimeoutEnv() {
         return undefined;
     const n = parseNumOrFail("HOOKS_TIMEOUT_MS", raw);
     if (!Number.isInteger(n) || n < 0 || n > 2147483647) {
-        throw new Error(`env HOOKS_TIMEOUT_MS="${raw}" must be an integer in [0, 2147483647] ms (0 = every hook seat expires immediately; unset = core's own default)`);
+        throw new Error(`env HOOKS_TIMEOUT_MS="${raw}" must be an integer in [0, 2147483647] ms (0 = a zero budget for every request-hook handler; unset = 600000)`);
     }
     return n;
 }
@@ -1026,7 +1059,7 @@ function parseModelDomain() {
         noticeAutoCompactAboveWindow("cheap", "MODEL_CHEAP_AUTO_COMPACT_TOKENS", cheapModel);
     }
     const models = envLaneTable(modelId, model, cheapModel);
-    const gatewayApiKey = process.env.MODEL_API_KEY;
+    const gatewayApiKey = route.gatewayApiKey;
     if (gatewayBaseUrl === undefined && gatewayApiKey !== undefined && gatewayApiKey !== "") {
         CONFIG_NOTICES.push({
             level: "warn",
@@ -1159,7 +1192,7 @@ function uncompilableRuleGuidance(name, behavior, pathBases) {
     const issue = issues[0];
     if (issue === undefined)
         return undefined;
-    return `${issue.code} — core's rule grammar cannot compile this entry: ${issue.message}`;
+    return { code: issue.code, guidance: `${issue.code} — core's rule grammar cannot compile this entry: ${issue.message}` };
 }
 function findUnmatchableToolNames(names, opts) {
     const out = [];
@@ -1167,42 +1200,46 @@ function findUnmatchableToolNames(names, opts) {
         if (opts.consumer === "tool-name-table") {
             const ccGuidance = ccRuleFormGuidance(name);
             if (ccGuidance !== undefined) {
-                out.push({ name, guidance: ccGuidance });
+                out.push({ name, guidance: ccGuidance, reason: "cc_rule_form" });
                 continue;
             }
         }
         const subject = opts.consumer === "tool-name-table" ? name : ruleEntryToolName(name);
         const verdict = unmatchableRuleNameOf(subject);
         if (verdict?.kind === "retired") {
-            out.push({ name, guidance: describeUnmatchableRuleName(verdict, subject) });
+            out.push({ name, guidance: describeUnmatchableRuleName(verdict, subject), reason: verdict.kind });
             continue;
         }
         const uncompilable = uncompilableRuleGuidance(name, opts.behavior, opts.pathBases);
         if (uncompilable !== undefined) {
-            out.push({ name, guidance: uncompilable });
+            out.push({ name, guidance: uncompilable.guidance, reason: uncompilable.code });
             continue;
         }
         if (verdict !== undefined) {
-            out.push({ name, guidance: describeUnmatchableRuleName(verdict, subject) });
+            out.push({ name, guidance: describeUnmatchableRuleName(verdict, subject), reason: verdict.kind });
             continue;
         }
         const nearMiss = compileAllowList([subject], "deny", TOOL_NAME_ROSTER).inert.find((i) => i.reason === "near_miss");
         if (nearMiss?.currentName !== undefined) {
             const rest = name.startsWith(subject) ? name.slice(subject.length) : "";
-            out.push({ name, guidance: inertRuleEntryGuidance({ ...nearMiss, currentName: `${nearMiss.currentName}${rest}` }) });
+            out.push({ name, guidance: inertRuleEntryGuidance({ ...nearMiss, currentName: `${nearMiss.currentName}${rest}` }), reason: nearMiss.reason });
         }
     }
     return out;
 }
 export function unmatchableToolNamesRefusal(source, names, judgment) {
+    const judged = judgeUnmatchableToolNames(source, names, judgment);
+    return judged === undefined ? undefined : { message: judged.message, names: judged.bad.map((b) => b.name) };
+}
+export function judgeUnmatchableToolNames(source, names, judgment) {
     const bad = findUnmatchableToolNames(names, judgment);
     if (bad.length === 0)
         return undefined;
     const named = bad.slice(0, MAX_NAMED_INERT_ENTRIES).map((b) => `${displayListEntry(b.name)} → ${b.guidance}`).join("; ");
-    const message = (`${source} has ${bad.length === 1 ? "an entry" : "entries"} that can never take effect — ${bad.length === 1 ? "it" : "each"} would never match a live tool or cannot be compiled into a rule ` +
+    const message = stripControlAndBidi(`${source} has ${bad.length === 1 ? "an entry" : "entries"} that can never take effect — ${bad.length === 1 ? "it" : "each"} would never match a live tool or cannot be compiled into a rule ` +
         `(names are read exactly as written: no alias folding, no protocol prefix added): ` +
-        (bad.length > MAX_NAMED_INERT_ENTRIES ? `${named}; and ${bad.length - MAX_NAMED_INERT_ENTRIES} more` : named)).replace(CONTROL_AND_BIDI_STRIP_RE, "");
-    return { message, names: bad.map((b) => b.name) };
+        (bad.length > MAX_NAMED_INERT_ENTRIES ? `${named}; and ${bad.length - MAX_NAMED_INERT_ENTRIES} more` : named));
+    return { message, bad };
 }
 const APPROVAL_GRANT_ENV = "APPROVAL_GRANT";
 export function approvalGrantRefusal(names) {
@@ -1257,7 +1294,7 @@ function unattendedApprovalPolicyEnv() {
         return "park";
     if (raw === "park" || raw === "deny")
         return raw;
-    throw new Error(`env UNATTENDED_APPROVAL_POLICY="${raw.slice(0, 120)}" is not a recognized value — use "park" (default: an ask nobody can answer becomes a durable park, the run suspends and waits for a human) ` +
+    throw new Error(`env UNATTENDED_APPROVAL_POLICY="${echoCallerText(raw, { maxChars: ENV_VALUE_ECHO_CHARS })}" is not a recognized value — use "park" (default: an ask nobody can answer becomes a durable park, the run suspends and waits for a human) ` +
         `or "deny" (an unattended/headless deployment declaring that NOBODY will ever answer: such asks are denied on the spot instead of piling up parked runs). ` +
         `The words are matched EXACTLY (lowercase, surrounding whitespace trimmed) and there is no "off" — both values are real postures, and unset simply means the documented default "park". ` +
         `Refusing to boot rather than treating a misspelled value as "unset": that runs the deployment on a policy the operator did not choose, with no trace anywhere`);
@@ -1339,7 +1376,7 @@ function parseApprovalDomain(ctx) {
                     `Use "always" to keep EVERY shell call behind an approval under every mode (bypassPermissions included), or unset it / "off" to rely on the engine's mode arbitration. ` +
                     `Refusing to boot rather than accepting it as a no-op: that would silently drop the half the operator configured it for`);
             }
-            throw new Error(`env MANUAL_MODE_SHELL_GATE="${trimmed.slice(0, 120)}" is not a recognized value — use "always" (every shell call is gated) or "off"/unset (this knob contributes nothing). ` +
+            throw new Error(`env MANUAL_MODE_SHELL_GATE="${echoCallerText(trimmed, { maxChars: ENV_VALUE_ECHO_CHARS })}" is not a recognized value — use "always" (every shell call is gated) or "off"/unset (this knob contributes nothing). ` +
                 `The words are matched EXACTLY (lowercase, surrounding whitespace trimmed): "OFF"/"Always" land here too, deliberately — a closed word table with no case-folding is what keeps "it looked accepted" from meaning "it did nothing". ` +
                 `Refusing to boot rather than treating a misspelled value as "unset": that silently ran the deployment with NO shell gate while the operator believed one was configured`);
         })(process.env.MANUAL_MODE_SHELL_GATE),
@@ -1348,6 +1385,7 @@ function parseApprovalDomain(ctx) {
         ...parseAutoModeClassifierTimeoutMs(process.env.AUTO_MODE_CLASSIFIER_TIMEOUT_MS),
         ...optionalEnumKey("crossSessionInbound", "CROSS_SESSION_INBOUND", process.env.CROSS_SESSION_INBOUND, CROSS_SESSION_INBOUND_SETTINGS),
         ...optionalEnumKey("crossSessionDialogExpiry", "CROSS_SESSION_DIALOG_EXPIRY", process.env.CROSS_SESSION_DIALOG_EXPIRY, CROSS_SESSION_DIALOG_EXPIRY_VALUES),
+        ...principalInboxAssistantKey(process.env.PRINCIPAL_INBOX_ASSISTANT),
         mcpElicitation: {
             enabled: boolEnv("MCP_ELICITATION_ENABLED", false),
             throttle: {
@@ -1372,8 +1410,20 @@ function parseApprovalDomain(ctx) {
         durableApprovalSource: postureSourceOfKnob("DURABLE_APPROVAL"),
         unattendedApprovalPolicy: unattendedPolicy,
         approvalTimeoutSec: numEnv("APPROVAL_TIMEOUT_SEC", "0"),
+        approvalAskRetentionMs: approvalAskRetentionEnv(),
     };
 }
+function approvalAskRetentionEnv() {
+    const n = numEnv("APPROVAL_ASK_RETENTION_MS", String(APPROVAL_ASK_RETENTION_DEFAULT_MS));
+    const raw = env("APPROVAL_ASK_RETENTION_MS", "");
+    if (n < 0 || !Number.isSafeInteger(n)) {
+        throw new Error(`env APPROVAL_ASK_RETENTION_MS="${raw}" must be 0 (keep the approval ledgers forever) or a whole number of milliseconds (the retention window)`);
+    }
+    if (n === 0 || n >= APPROVAL_ASK_RETENTION_FLOOR_MS)
+        return n;
+    CONFIG_WARNINGS.push({ env: "APPROVAL_ASK_RETENTION_MS", raw, used: String(APPROVAL_ASK_RETENTION_FLOOR_MS), kind: "clamped" });
+    return APPROVAL_ASK_RETENTION_FLOOR_MS;
+}
 const MEMORY_ENGINE_ON_WORDS = ["on", "true", "1", "yes", "enabled"];
 const MEMORY_ENGINE_OFF_WORDS = ["off", "false", "0", "no", "disabled"];
 function parseMemoryEngineWord(word) {
@@ -1423,6 +1473,13 @@ function pkgSourceEnv() {
     }
     return v;
 }
+function pkgSourceFields() {
+    if (process.env.SANDBOX_PKG_SOURCE === "none")
+        return {};
+    const sandboxPkgSource = pkgSourceEnv();
+    const custom = sandboxPkgSource === "custom" ? customPkgSourceFromEnv() : {};
+    return { sandboxPkgSource, ...(Object.keys(custom).length > 0 ? { sandboxPkgSourceCustom: custom } : {}) };
+}
 function syncEntryCap(name, field) {
     const raw = process.env[name];
     if (raw === undefined || raw === "")
@@ -1585,6 +1642,8 @@ function parseMemoryDomain(ctx) {
     const memoryEngineEnabled = parseMemoryEngineWord(env("MEMORY_ENGINE", "on"));
     const memoryEngineBackend = enumEnv("MEMORY_ENGINE_BACKEND", "file", MEMORY_ENGINE_BACKENDS);
     const memoryScope = process.env.MEMORY_SCOPE ?? (memoryEngineEnabled && !requirePrincipal ? "local" : undefined);
+    if (memoryScope !== undefined && memoryEngineEnabled && !requirePrincipal)
+        assertProjectLayerOwnable(memoryScope, "MEMORY_SCOPE");
     const memorySyncUrl = process.env.MEMORY_SYNC_URL || undefined;
     const memorySyncToken = process.env.MEMORY_SYNC_TOKEN || undefined;
     const memorySyncScopeRaw = process.env.MEMORY_SYNC_SCOPE || undefined;
@@ -1610,6 +1669,7 @@ function parseMemoryDomain(ctx) {
         if (scope === undefined) {
             throw new Error("MEMORY_SYNC_URL is set but no sync scope is derivable (memory engine off or multi-tenant without an explicit scope) — set MEMORY_SYNC_SCOPE, or run the single-user file memory engine with a typed MEMORY_SCOPE (e.g. user:<tenant>) so it provides one");
         }
+        assertProjectLayerOwnable(scope, memorySyncScopeRaw !== undefined ? "MEMORY_SYNC_SCOPE" : "MEMORY_SCOPE");
         memorySync = {
             url: memorySyncUrl,
             token: memorySyncToken,
@@ -1619,23 +1679,17 @@ function parseMemoryDomain(ctx) {
         };
     }
     const replication = memoryReplicationCoverage(memorySync !== undefined ? { memorySync } : {});
-    if (replication.kind === "scopes" && memoryEngineEnabled && !requirePrincipal && memoryScope !== undefined) {
-        const YIELD_HINT = {
-            in: "memory sync (MEMORY_SYNC_*) replicates only the scope(s) listed in replicatedScopes — the per-project memory layer (S-512, repo:<key>) is not replicated, " +
-                "so sessions do NOT write project-keyed memory here: new memory lands in the global layer (writeScope = MEMORY_SCOPE), which IS replicated, and every " +
-                "project reads it. Project-layer replication is a separate change; unset MEMORY_SYNC_URL to get per-project memory without sync.",
-            out: "memory sync (MEMORY_SYNC_*) replicates only the scope(s) listed in replicatedScopes — the per-project memory layer (S-512, repo:<key>) is not replicated, " +
-                "so sessions do NOT write project-keyed memory here: new memory lands in the global layer (writeScope = MEMORY_SCOPE), every project reads it, " +
-                "and that write scope is not among the replicated scopes either — NONE of the memory this deployment writes is synced. " +
-                "Point MEMORY_SYNC_SCOPE at the write scope (sync replicates one scope), or unset MEMORY_SYNC_URL to stop expecting sync.",
-        };
+    if (replication.kind === "layers" && memoryEngineEnabled && !requirePrincipal && memoryScope !== undefined && !replicatesProjectLayersOf(replication, projectLayerOwnerOf(memoryScope))) {
         CONFIG_NOTICES.push({
             level: "warn",
             event: "memory_project_scope_yields_to_sync",
             fields: {
-                replicatedScopes: replication.scopes.join(","),
+                replicatedScopes: replication.layers.join(","),
                 writeScope: memoryScope,
-                hint: YIELD_HINT[replicationCovers(replication, memoryScope) ? "in" : "out"],
+                hint: "memory sync (MEMORY_SYNC_*) replicates the scope(s) listed in replicatedScopes and the per-project memory layers of the same owner; " +
+                    "this deployment's project layers belong to MEMORY_SCOPE, which has a different owner, so sessions do NOT write project-keyed memory here: " +
+                    "new memory lands in the global layer (writeScope = MEMORY_SCOPE), every project reads it, and NONE of the memory this deployment writes is synced. " +
+                    "Set MEMORY_SCOPE to the replicated user key (the same value as MEMORY_SYNC_SCOPE) to sync the global and per-project layers, or unset MEMORY_SYNC_URL to stop expecting sync.",
             },
         });
     }
@@ -1768,6 +1822,7 @@ function parseAuthDomain(ctx) {
         autonomy: parseAutonomy(process.env.AUTONOMY),
         ...parseGovernanceDeclarations(),
         operatorPrincipals: csv("OPERATOR_PRINCIPALS"),
+        operatorSingleUser: boolEnv("OPERATOR_SINGLE_USER", false),
         configCatalogEnabled: boolEnv("CONFIG_CATALOG_ENABLED", true),
         principalJwtPubkeys,
         principalJwtIss,
@@ -1812,10 +1867,7 @@ function parseOrchestrationDomain(ctx) {
     }
     const readFaceFacts = process.env.READ_FACE !== undefined
         ? { readFace: enumEnv("READ_FACE", "roots", ["open", "roots"]), readFaceSource: "env" }
-        : readFaceForPosture(singleUserTurnkey);
-    const readFaceNotice = buildReadFacePostureNotice(readFaceFacts);
-    if (readFaceNotice !== undefined)
-        CONFIG_NOTICES.push({ level: "info", ...readFaceNotice });
+        : { readFaceSource: "engine-default" };
     return {
         requireExecutionLane: boolEnv("REQUIRE_EXECUTION_LANE", false),
         ...readFaceFacts,
@@ -1923,10 +1975,10 @@ function parseOrchestrationDomain(ctx) {
                                                         process.env.REMOTE_EXEC === "device"
                                                             ? {
                                                                 provider: "device",
-                                                                ...((n) => (n !== undefined ? { deliveryTimeoutMs: n } : {}))(optNumEnvStrict("DEVICE_DELIVERY_TIMEOUT_MS")),
-                                                                ...((n) => (n !== undefined ? { reconnectGraceMs: n } : {}))(optNumEnvStrict("DEVICE_RECONNECT_GRACE_MS")),
-                                                                ...((n) => (n !== undefined ? { execTimeoutMs: n } : {}))(optNumEnvStrict("DEVICE_EXEC_TIMEOUT_MS")),
-                                                                ...((n) => (n !== undefined ? { maxInflightPerDevice: n } : {}))(optNumEnvStrict("DEVICE_MAX_INFLIGHT_PER_DEVICE")),
+                                                                ...((n) => (n !== undefined ? { deliveryTimeoutMs: n } : {}))(parseDeviceBoundedIntEnv("DEVICE_DELIVERY_TIMEOUT_MS", process.env.DEVICE_DELIVERY_TIMEOUT_MS, DEVICE_DELIVERY_TIMEOUT_BOUNDS)),
+                                                                ...((n) => (n !== undefined ? { reconnectGraceMs: n } : {}))(parseDeviceBoundedIntEnv("DEVICE_RECONNECT_GRACE_MS", process.env.DEVICE_RECONNECT_GRACE_MS, DEVICE_HELLO_ACK_BOUNDS.reconnectGraceMs)),
+                                                                ...((n) => (n !== undefined ? { execTimeoutMs: n } : {}))(parseDeviceBoundedIntEnv("DEVICE_EXEC_TIMEOUT_MS", process.env.DEVICE_EXEC_TIMEOUT_MS, DEVICE_EXEC_TIMEOUT_BOUNDS)),
+                                                                ...((n) => (n !== undefined ? { maxInflightPerDevice: n } : {}))(parseDeviceBoundedIntEnv("DEVICE_MAX_INFLIGHT_PER_DEVICE", process.env.DEVICE_MAX_INFLIGHT_PER_DEVICE, DEVICE_HELLO_ACK_BOUNDS.maxInflight)),
                                                                 ...((n) => (n !== undefined ? { maxPreAuthPerRemote: n } : {}))(parseDevicePreAuthPerRemoteEnv()),
                                                                 ...((n) => (n !== undefined ? { enrollTokenTtlSec: n } : {}))(parseDeviceEnrollTokenTtlEnv()),
                                                                 ...(process.env.DEVICE_SUPERSEDE ? { supersede: enumEnv("DEVICE_SUPERSEDE", "stale_only", ["stale_only", "deny"]) } : {}),
@@ -1978,9 +2030,7 @@ function parseOrchestrationDomain(ctx) {
             }
             return n;
         })(numEnv("SCRATCHPAD_SWEEP_TTL_MS", String(7 * 24 * 60 * 60 * 1000)), env("SCRATCHPAD_SWEEP_TTL_MS", String(7 * 24 * 60 * 60 * 1000))),
-        ...(process.env.SANDBOX_PKG_SOURCE !== "none"
-            ? { sandboxPkgSource: pkgSourceEnv() }
-            : {}),
+        ...pkgSourceFields(),
         sessionAutoTitle: boolEnv("SESSION_AUTO_TITLE", true),
         sessionAutoTitleSource: postureSourceOfKnob("SESSION_AUTO_TITLE"),
         selectEnvironmentTool: boolEnv("SELECT_ENVIRONMENT_TOOL", true),
@@ -2117,6 +2167,7 @@ function parseGitApiKind(raw, baseUrl) {
 }
 function parseIntegrationsDomain(ctx) {
     const { requirePrincipal, configProvider } = ctx;
+    const configLocalOwnerUid = parseConfigLocalOwnerUid(process.env.CONFIG_LOCAL_OWNER_UID);
     const baseUrl = parseCenterBaseUrl(WEB_ADMIN_ENV.url, process.env[WEB_ADMIN_ENV.url], `It is the center base every config pull, fleet and lease request is sent to; setting it selects the center as the config source.`);
     const liveBaseUrl = parseCenterBaseUrl(WEB_ADMIN_ENV.liveUrl, process.env[WEB_ADMIN_ENV.liveUrl], `It is the center base the fleet liveness endpoints (heartbeat, serving lease) are sent to; unset it to send them to ${WEB_ADMIN_ENV.url}.`);
     const webBaseUrl = parseCenterBaseUrl(WEB_ADMIN_ENV.webUrl, process.env[WEB_ADMIN_ENV.webUrl], `It is the center's web console base this engine reports on GET /health (center.webBaseUrl); unset it if the center has no web console to link to.`);
@@ -2141,6 +2192,7 @@ function parseIntegrationsDomain(ctx) {
         fleetLeaseOutageMaxMs: parseFleetLeaseOutageMaxMs(process.env.FLEET_LEASE_OUTAGE_MAX_MS),
         ...(configProvider !== undefined ? { configProvider } : {}),
         configLocalDir: process.env.CONFIG_LOCAL_DIR || undefined,
+        ...(configLocalOwnerUid !== undefined ? { configLocalOwnerUid } : {}),
         a2aServe: parseA2aServe(),
     };
 }
@@ -2326,10 +2378,10 @@ const MODEL_PLANE_GROUP_KEYS = [
     "modelApiKeyEnv", "modelApiKeys", "modelRefusals", "droppedCatalogEntries", "modelQuotaWeights", "tiers", "projects", "roles", "atMention", "cascadeLadder", "degrade",
 ];
 const APPROVAL_GROUP_KEYS = [
-    "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto", "approvalGrant",
+    "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAskRetentionMs", "approvalAutoBudget", "approvalNeverAuto", "approvalGrant",
     "approvalHmacKeys", "durableApproval", "durableApprovalSource", "streamAskWindowMsSource", "directApprovalDoor", "directDoorActive", "resourceSuspend",
     "resourceSuspendTtlSec", "resourceSuspendTotalTokens", "resourceSuspendTotalBudgetUsd", "resourceSuspendMaxSlices", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "permissionRulesEnabled", "permissionRulesEnabledExplicit", "streamAskWindowMarginMs", "streamApproval", "unattendedApprovalPolicy", "mcpElicitation",
-    "sensitiveWritePatterns", "writeProtectedPaths", "manualModeShellGate", "permissionsDisableAutoMode", "autoModeClassifierFallback", "autoModeClassifierTimeoutMs", "crossSessionInbound", "crossSessionDialogExpiry",
+    "sensitiveWritePatterns", "writeProtectedPaths", "manualModeShellGate", "permissionsDisableAutoMode", "autoModeClassifierFallback", "autoModeClassifierTimeoutMs", "crossSessionInbound", "crossSessionDialogExpiry", "principalInboxAssistant",
 ];
 const MEMORY_GROUP_KEYS = [
     "memoryEngineEnabled", "memoryEngineDir", "memoryEngineRemoteLaneAllowed", "memoryEngineBackend", "memoryScope",
@@ -2339,7 +2391,7 @@ const MEMORY_GROUP_KEYS = [
 const AUTH_GROUP_KEYS = [
     "authToken", "authTokens", "allowUnauthedWrites", "corsOrigins", "principalHeader", "requirePrincipal", "autonomy",
     "commandPolicy", "compliancePosture", "lockedConfigKeys", "retentionPolicy", "retentionSweep",
-    "operatorPrincipals", "configCatalogEnabled", "principalJwtPubkeys", "principalJwtIss", "principalJwtAud",
+    "operatorPrincipals", "operatorSingleUser", "configCatalogEnabled", "principalJwtPubkeys", "principalJwtIss", "principalJwtAud",
     "principalJwtMaxTtlSec", "authBridgeIssuer", "bindHost", "bindHostSource",
 ];
 const ORCHESTRATION_GROUP_KEYS = [
@@ -2348,7 +2400,7 @@ const ORCHESTRATION_GROUP_KEYS = [
     "schedulerEnabled", "schedulerSessionWakeup", "schedulerSessionLifetime", "schedulerStorePath", "planModeEnabled", "hooksTimeoutMs", "workflowRunStoreBackend",
     "workflowOrphanGraceMs", "workflowJournalRetentionMs", "workflowRunRetentionMs", "usageWindows", "workflowAgentsReadOnly",
     "workflowSizeGuideline", "backgroundAgentRetentionMs", "backgroundAgentStaleRunningMs",
-    "backgroundAgentParkClaimStaleMs", "delegationEntryCaps", "rosterRetentionMs", "leaderRunStaleMs", "scratchpadSweepTtlMs", "sandboxPkgSource",
+    "backgroundAgentParkClaimStaleMs", "delegationEntryCaps", "rosterRetentionMs", "leaderRunStaleMs", "scratchpadSweepTtlMs", "sandboxPkgSource", "sandboxPkgSourceCustom",
     "sessionAutoTitle", "sessionAutoTitleSource", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspEnabled", "lspHostEnabled", "lspEnvAllow",
     "imageBakes", "readFace", "readFaceSource", "taskWriteFaceEscalation", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude",
     "agentConfigDir", "configLkgPath", "configLkgEnabled",
@@ -2363,7 +2415,7 @@ const LIMITS_HTTP_GROUP_KEYS = [
 const OBSERVABILITY_GROUP_KEYS = ["metricsToken", "traceToken", "toolTrace", "traceThinking", "logLevel", "otel"];
 const INTEGRATIONS_GROUP_KEYS = [
     "pluginsAllowHosts", "mcpServers", "a2aPeers", "a2aServe", "configBootFetchBudgetMs", "gitApiBaseUrl", "gitApiToken", "gitApiKind", "defaultScenario",
-    "skillsDir", "centerCredentialRenewLeadMs", "webAdmin", "fleetLeaseFailClosed", "fleetGeneration", "fleetScope", "fleetAdvertiseAddress", "fleetLeaseOutageMaxMs", "configProvider", "configLocalDir",
+    "skillsDir", "centerCredentialRenewLeadMs", "webAdmin", "fleetLeaseFailClosed", "fleetGeneration", "fleetScope", "fleetAdvertiseAddress", "fleetLeaseOutageMaxMs", "configProvider", "configLocalDir", "configLocalOwnerUid",
 ];
 export const CONFIG_GROUP_KEYS = {
     store: STORE_GROUP_KEYS,
@@ -2461,6 +2513,11 @@ function k8sWorkspaceCache() {
         throw new Error(`env WORKSPACE_CACHE_MOUNT=${mount} overlaps the workspace mount ${workspace} (K8S_MOUNT_PATH) — the cache volume must sit OUTSIDE the workspace ` +
             "(the workspace is snapshotted between runs, the cache is not); pick a separate absolute path such as /cache");
     }
+    const reserved = reservedMountCollision(mount);
+    if (reserved !== undefined) {
+        throw new Error(`env WORKSPACE_CACHE_MOUNT=${mount} collides with the reserved image directory ${reserved} (a volume at, under or above it hides what the sandbox image keeps there) — ` +
+            `pick a separate absolute path such as /cache; reserved: ${WORKSPACE_CACHE_MOUNT_RESERVED.join(" ")}`);
+    }
     return { mount, size };
 }
 export function loadConfig() {
@@ -2485,6 +2542,10 @@ export function loadConfig() {
     const memory = parseMemoryDomain({ requirePrincipal });
     const auth = parseAuthDomain({ requirePrincipal });
     const orchestration = parseOrchestrationDomain({ postureOn, singleUserTurnkey, configProvider });
+    settleDerivedReadFace(orchestration, singleUserTurnkey);
+    const readFaceNotice = buildReadFacePostureNotice(orchestration);
+    if (readFaceNotice !== undefined)
+        CONFIG_NOTICES.push({ level: "info", ...readFaceNotice });
     const limitsHttp = parseLimitsHttpDomain();
     const observability = parseObservabilityDomain();
     const integrations = parseIntegrationsDomain({ requirePrincipal, configProvider });
@@ -2493,7 +2554,7 @@ export function loadConfig() {
         throw new Error(centerIdentity);
     }
     const { directApprovalDoor, durableApproval: dgDurable, approvalHmacKeys: dgHmacKeys } = approval;
-    const { principalJwtPubkeys, principalJwtIss, principalJwtAud, operatorPrincipals: dgOperators, authTokens } = auth;
+    const { principalJwtPubkeys, principalJwtIss, principalJwtAud, operatorPrincipals: dgOperators, operatorSingleUser, authTokens } = auth;
     const directDoorActive = directApprovalDoor && dgDurable && dgHmacKeys.length > 0 && principalJwtPubkeys.length > 0 && !!principalJwtIss && !!principalJwtAud;
     const doorRefusal = halfOpenDirectDoorRefusal({
         directApprovalDoor,
@@ -2512,6 +2573,10 @@ export function loadConfig() {
     if (operatorsRefusal !== undefined) {
         throw new Error(operatorsRefusal);
     }
+    const singleUserOperatorRefusal = operatorSingleUserRefusal({ operatorSingleUser, requirePrincipal, operatorPrincipals: dgOperators });
+    if (singleUserOperatorRefusal !== undefined) {
+        throw new Error(singleUserOperatorRefusal);
+    }
     const bakeOperatorsRefusal = bakeOperatorPrincipalsRefusal({ imageBakes: orchestration.imageBakes, operatorPrincipals: dgOperators });
     if (bakeOperatorsRefusal !== undefined) {
         throw new Error(bakeOperatorsRefusal);
@@ -2524,6 +2589,16 @@ export function loadConfig() {
     if (leaderStoreRefusal !== undefined) {
         throw new Error(leaderStoreRefusal);
     }
+    const parkDecisionDomainRefusal = workflowParkDecisionDomainRefusal({
+        selfOrchestrationEnabled: orchestration.selfOrchestrationEnabled,
+        workflowRunStoreBackend: orchestration.workflowRunStoreBackend,
+        dbBackend: store.dbBackend,
+        tidb: store.tidb,
+        pg: store.pg,
+    });
+    if (parkDecisionDomainRefusal !== undefined) {
+        throw new Error(parkDecisionDomainRefusal);
+    }
     const laneRequiredRefusal = executionLaneRequiredRefusal(orchestration);
     if (laneRequiredRefusal !== undefined) {
         throw new Error(laneRequiredRefusal);